Fix silent truncations when extracting values from CheckedNumeric

sandbox/win/src/win_utils.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/win_utils.h"
 
 #include <psapi.h>
 #include <stddef.h>
 #include <stdint.h>
 
@@ skipping 471 matching lines @@
         EqualPath(process_path, image_path)) {
       return mem_info.BaseAddress;
     }
     // VirtualQueryEx should fail before overflow, but just in case we'll check
     // to prevent an infinite loop.
     base::CheckedNumeric<uintptr_t> next_base =
         reinterpret_cast<uintptr_t>(mem_info.BaseAddress);
     next_base += mem_info.RegionSize;
     if (!next_base.IsValid())
       return nullptr;
-    current = reinterpret_cast<void*>(next_base.ValueOrDie());
+    current =
+        reinterpret_cast<void*>(static_cast<uintptr_t>(next_base.ValueOrDie()));
   }
 
   return nullptr;
 }
 
 };  // namespace sandbox
 
 void ResolveNTFunctionPtr(const char* name, void* ptr) {
   static volatile HMODULE ntdll = NULL;
 
   if (!ntdll) {
     HMODULE ntdll_local = ::GetModuleHandle(sandbox::kNtdllName);
     // Use PEImage to sanity-check that we have a valid ntdll handle.
     base::win::PEImage ntdll_peimage(ntdll_local);
     CHECK_NT(ntdll_peimage.VerifyMagic());
     // Race-safe way to set static ntdll.
     ::InterlockedCompareExchangePointer(
         reinterpret_cast<PVOID volatile*>(&ntdll), ntdll_local, NULL);
   }
 
   CHECK_NT(ntdll);
   FARPROC* function_ptr = reinterpret_cast<FARPROC*>(ptr);
   *function_ptr = ::GetProcAddress(ntdll, name);
   CHECK_NT(*function_ptr);
 }